EUVD-2026-102434Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed FastAPI inference service on network
-
ExploitInvoke unauthenticated model-administration API
-
ExecutionRewrite config and switch active model
-
ImpactAlter or disrupt robot AI inference behavior
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required to reach the AI model administration endpoints of the EnergizeLab Eilik/EilikO FastAPI inference and profiling service; exploitation needs only HTTP reachability to that service with no credentials, user interaction, or non-default configuration (CWE-306, PR:N/UI:N). The key limiting factor is network exposure: this service runs on a consumer desktop robot and typically listens on a local/home network rather than the public internet, so an attacker generally must be on the same LAN - or the device must be deliberately exposed/port-forwarded - to reach the vulnerable endpoint. Affected scope is specifically the Eilik and EilikO inference/profiling service, not a broadly-deployed server platform. |
| Impact | The supplied CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on paper signals a critical, trivially-exploitable, unauthenticated remote flaw - consistent with the CWE-306 'Missing Authentication for Critical Function' classification and the description of admin endpoints exposed without auth. However, the other risk signals that would confirm real-world priority are absent or weak: no EPSS exploitation-probability score is provided, there is no CISA KEV listing (so exploitation status is 'no public exploit identified at time of analysis'), no SSVC decision data is supplied, and POC availability cannot be confirmed - one reference is a suggestively-named GitHub repo but its contents are unverified. Two mitigating realities pull the practical risk well below the 9.8 headline: (1) the affected product is the EnergizeLab Eilik/EilikO - a consumer desktop companion robot, not enterprise infrastructure - so blast radius per incident is low; and (2) although CVSS encodes AV:N, the FastAPI inference/profiling service on such a device realistically runs on a home/LAN rather than being internet-facing, so attacker reachability is usually local-network-bounded unless the device is deliberately exposed. Additionally, the claimed confidentiality impact (C:H) is not well supported by the description, which only describes changing configuration and switching the model (integrity/availability), suggesting C:H may be overstated - verify with the reporter. Net assessment: a genuine unauthenticated-access weakness, but a targeted/niche-product issue rather than a widespread enterprise emergency. |
| Exploit ScenarioDerived | An attacker with reachability to an Eilik/EilikO robot's FastAPI inference and profiling service sends an HTTP request directly to its model-administration endpoints, which perform no authentication check (CWE-306). The attacker rewrites the AI model configuration or switches the active model at runtime, manipulating or disrupting the robot's AI behavior. No public exploit has been confirmed at time of analysis, though one referenced GitHub repository may contain related material. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated model administration in the EnergizeLab Eilik and EilikO companion robots allows any party who can reach the on-device FastAPI AI inference and profiling service over the network to alter AI model configuration and swap the model loaded at runtime, with no credentials or user interaction required (CWE-306). The supplied CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); an independent re-assessment keeps the same unauthenticated, network-reachable vector but rates confidentiality impact as Low and lands on AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, reflecting that the exposed functions are configuration/administration rather than data-exfiltration endpoints. The practical constraint is exposure: the service runs on a consumer desktop robot that normally listens only on a local or home network, so an attacker generally needs LAN adjacency or a deliberately port-forwarded/exposed device. No public exploit code and no CISA KEV listing were identified at time of analysis, and no vendor-released patch was identified in the provided data.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with exposure control. The primary compensating control is network isolation: keep the Eilik/EilikO inference and profiling service reachable only from a trusted home LAN or an isolated IoT VLAN, and do not port-forward it to the internet or place it on a guest/untrusted segment. If the device or companion app allows it, disable the profiling/AI-admin endpoints entirely or restrict the listening interface to loopback only; the trade-off is that remote management, telemetry and any app-driven model updates that rely on those endpoints will stop working. Where the service must remain reachable on the LAN, enforce source-address restrictions with host firewall rules so only known management hosts can reach the model-administration routes, accepting that LAN-adjacent attackers who can spoof or join the segment still retain access. Because the flaw is missing authentication rather than a bypass, an authenticating reverse proxy or API gateway placed in front of the service can restore access control without modifying the firmware, at the cost of added latency and the operational burden of maintaining that gateway. Monitor for unexpected model changes or configuration resets as a detection measure, and watch the vendor and the referenced public write-up (https://github.com/xn0tsa/your-secrets-are-safe-with-me) for a firmware update; apply it as soon as an exact patched version is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the FastAPI-based AI inference and profiling service shipped with the EnergizeLab Eilik and EilikO consumer robots, represented in the CPE data as cpe:2.3:a:energizelab:fastapi_ai_inference_server:*:*:*:*:*:*:*:* (all versions). The root cause is CWE-306, Missing Authentication for Critical Function: the service exposes AI model administration operations - changing model configuration and switching which model is active at runtime - as HTTP endpoints that are reachable without any authentication check. Because FastAPI services typically bind to a network interface and expose documented or discoverable routes, an attacker on the same subnet can enumerate and invoke these administrative functions directly. The AI model pipeline is the trust boundary here: substituting or reconfiguring the model affects the robot's behavior and, depending on downstream code that consumes model output, the integrity and availability of the device's core functionality. The mismatch between the supplied score (C:H) and the independently assessed score (C:L) stems from the nature of the exposed functionality: it is administrative control over model selection and configuration, not direct access to stored user data.
Know when Fastapi Ai Inference Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable admin endpoint gives AV:N/AC:L/PR:N/UI:N; described impact is config change and runtime model switch (I:H, A:H), with only limited confidentiality exposure (C:L), so input C:H appears overstated.
Primary rating from Vendor (AHA).
CVSS VectorVendor: AHA
DescriptionCVE.org
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
Executive ViewAI
EnergizeLab's Eilik and EilikO companion robots expose an unauthenticated network service that allows anyone able to reach the device to replace the AI model it runs at runtime, with no credentials or user interaction required. No vendor patch currently exists, so any organization that has placed these robots in offices, lobbies, demo labs, or research settings carries an unremediated integrity risk to AI-driven behavior. Leadership should treat this as a trust and physical-safety concern tied to what these devices say and do, not as a conventional data-breach exposure, and note that exploitation requires network adjacency to the robot.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate Eilik and EilikO devices on a dedicated VLAN or guest network with no inbound access from user or corporate subnets, block the unauthenticated FastAPI administration service port at the perimeter, disable remote port-forwarding and unnecessary Wi-Fi connectivity, restrict devices to trusted LANs only, and monitor for unexpected model or configuration changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB